function do_hook() {

    var addr = Module.findExportByName("libkeyinfo.so", "getByteHash");
    console.log(addr); //0xb696387d


    Interceptor.attach(addr, {
        onEnter: function (args) {
            this.x1 = args[2];
        },
        onLeave: function (retval) {
            console.log("--------------------")
            console.log(Memory.readCString(this.x1));
            console.log(Memory.readCString(retval));
        }

    })

}

function load_so_and_hook() {
    var dlopen = Module.findExportByName(null, "dlopen");
    var android_dlopen_ext = Module.findExportByName(null, "android_dlopen_ext");

    Interceptor.attach(dlopen, {
        onEnter: function (args) {
            var path_ptr = args[0];
            var path = ptr(path_ptr).readCString();
            // console.log("[dlopen:]", path);
            this.path = path;
        }, onLeave: function (retval) {
            if (this.path.indexOf("libkeyinfo.so") !== -1) {
                console.log("[dlopen:]", this.path);
                do_hook();

            }
        }
    });

    Interceptor.attach(android_dlopen_ext, {
        onEnter: function (args) {
            var path_ptr = args[0];
            var path = ptr(path_ptr).readCString();

            this.path = path;
        },
        onLeave: function (retval) {
            if (this.path.indexOf("libkeyinfo.so") !== -1) {
                console.log("\nandroid_dlopen_ext加载：", this.path);
                do_hook();

            }
        }
    });
}

load_so_and_hook();

// frida -UF -l 1_hook_getByteHash.js                          手动启动+hook
// frida -H 127.0.0.1:8877 -l  1_hook_getByteHash.js -U -f com.achievo.vipshop
// frida -H 127.0.0.1:8877 -l  2_delay_hook.js -f com.achievo.vipshop
